mirror of
https://github.com/Horizontal42/summarum.git
synced 2026-11-10 15:42:01 +03:00
c1a7254fdf
Both Tauri commands took a raw path string straight from the frontend and wrote to it with no validation — any code able to call invoke() (a compromised or malicious extension script, which run with full page privileges) could write to any path the OS user has access to, not just one chosen through the save dialog. Move the save-file dialog into the Rust command itself so the only path ever used is one the native dialog returned; the frontend now only sends the content to save. |
||
|---|---|---|
| .. | ||
| capabilities | ||
| icons | ||
| src | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| extension-sample.js | ||
| tauri.conf.json | ||